Overview

overview

10

Static

static

8

20e99a3063...a4.exe

windows7-x64

10

20e99a3063...a4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 18:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4.exe

  • Size

    442KB

  • MD5

    80d4dbad15dfa69738e964fd6e91668a

  • SHA1

    88f93da6b0f4245bff0890fd653a3077986423cb

  • SHA256

    20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4

  • SHA512

    899ad0b129e1c6e321c034d9171551f2fe021fe06f77fb5cfa53fc82a32bd5d33ba7bba5b1c3ddea65d801ee7c0b840c2794b10bb5447b52c1a708454fe2a465

  • SSDEEP

    1536:cd04boUzdIBsZUpUQSe1sjL/91IqmM4nouy8:cdJboUpEsueFssP11I5Mwout

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4.exe
    "C:\Users\Admin\AppData\Local\Temp\20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2368
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:1700
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1476

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02
            Filesize

            978B

            MD5

            44a5f25833268a3ef76c4b20b6f8aabb

            SHA1

            a5efeee86336b66d9005f94a739477de89e809bf

            SHA256

            287a6a8ffb31ff0d94bdd374a8666b52b8e569d01c5de10bd982e3b63a4f6264

            SHA512

            f9c105e3a296fb61b9596bf1ab8919d48c31143b856d4382df623b481810655afa897a8ab08c5bb658fc6bcb7aee66e8ebb651ac675fbebafb150984863ae719

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            1KB

            MD5

            916c512d221c683beeea9d5cb311b0b0

            SHA1

            bf0db4b1c4566275b629efb095b6ff8857b5748e

            SHA256

            64a36c1637d0a111152002a2c0385b0df9dd81b616b3f2073fbbe3f2975aa4d8

            SHA512

            af32cffea722438e9b17b08062dc2e209edc5417418964ead0b392bd502e1a647a8456b2ee2ea59faf69f93d0c6ea6f15949b6c30924db7da65b91cb18e8dc6c

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
            Filesize

            472B

            MD5

            cfbcb12817712d4f8f816c208590444a

            SHA1

            9999caeedbb1a95ae4236a5b962c233633df6799

            SHA256

            b5a41ab77d5ff4ba1a17ff074eb91bc18824d56dfc4b6c3320e900bbd6f3a90a

            SHA512

            a70eb8c366dfa0226cd62dbffbf51bd2da25571a6ff6b1f2e44dd8d9193a72f79ab7d90367378edf808ff3152ca45bf2a6ba3d64882d0f6d4aa437b6881d13f2

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02
            Filesize

            274B

            MD5

            ac38ed1695f0c0a707a882b7695cbc04

            SHA1

            178334a8b043a7cbc68a61e1f5677dfd352489a7

            SHA256

            d0f0133511a4492aaeb957816258cb4e5836125a8a93150a08cecaa851e6c46f

            SHA512

            2a88c70b4caca7392e6414c022e8e29a3ce04c1689dcb5beed658b60a64164acf4d95bd7abadb451624e7a785e4036ba5111e29a5335b6f2838140b8dcefc21b

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            482B

            MD5

            ae2367e1cfb0640e2ef78778c951d91c

            SHA1

            1a96390cbb24500c9a06dec8b3f72a400226ec53

            SHA256

            42a7394b35015a9ef857c3caa927f0905e7df850622a9f64ab204a891bfb5afc

            SHA512

            05f852ee22cdf8ba0a19bd322682883d44e3fe6295edcc98e1aa997231741635a403b71f123c909a41d39efdd6a50534a82d4041f1a3b63c4ecaef5ffba33c2d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
            Filesize

            480B

            MD5

            6eb436a2e9c334e0ae73046116b55305

            SHA1

            ad380c7d72b965b745a5e14cc9e0f3cd3c5a0c6a

            SHA256

            e48a8fe7306c0b80f944f442c7ae4732b0115fc85167a81338b064afd1f6dfea

            SHA512

            c17c6f4452e041f46fdf568c0705563074bdef62afecb4ea2e11e867528e2760295311023af57c7d3c4a8068ee5db55f721950e24a0212331828ef362ee34bef

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            442KB

            MD5

            80d4dbad15dfa69738e964fd6e91668a

            SHA1

            88f93da6b0f4245bff0890fd653a3077986423cb

            SHA256

            20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4

            SHA512

            899ad0b129e1c6e321c034d9171551f2fe021fe06f77fb5cfa53fc82a32bd5d33ba7bba5b1c3ddea65d801ee7c0b840c2794b10bb5447b52c1a708454fe2a465

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            442KB

            MD5

            80d4dbad15dfa69738e964fd6e91668a

            SHA1

            88f93da6b0f4245bff0890fd653a3077986423cb

            SHA256

            20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4

            SHA512

            899ad0b129e1c6e321c034d9171551f2fe021fe06f77fb5cfa53fc82a32bd5d33ba7bba5b1c3ddea65d801ee7c0b840c2794b10bb5447b52c1a708454fe2a465

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            442KB

            MD5

            80d4dbad15dfa69738e964fd6e91668a

            SHA1

            88f93da6b0f4245bff0890fd653a3077986423cb

            SHA256

            20e99a3063d035f8d107713da83710daf23456e764133590660e02e3877b9da4

            SHA512

            899ad0b129e1c6e321c034d9171551f2fe021fe06f77fb5cfa53fc82a32bd5d33ba7bba5b1c3ddea65d801ee7c0b840c2794b10bb5447b52c1a708454fe2a465

            Download Submit

          • memory/2368-147-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2368-148-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2368-151-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2368-144-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2368-158-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4460-132-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download

          • memory/4460-138-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download

          • memory/5040-142-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download

          • memory/5040-141-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download